Meta Ordered to Pay $25B in New Mexico Privacy Case

A $25B judgment has turned a privacy promise into a balance-sheet argument.

A New Mexico judge ordered Meta to pay $25B after a jury found that Facebook made false or misleading statements about how it collected, protected, shared and used personal information. The jury counted 43,899,725 violations of the New Mexico Unfair Practices Act in a case rooted in the Cambridge Analytica scandal.

Meta has said it plans to appeal. The company has not paid the award, and the amount may change as the appellate courts examine the violation count, the constitutional limits on the penalty and the state's theory of consumer harm.

The ruling matters beyond its size. It shows what can happen when years of public statements about data practices are treated as separate consumer representations rather than one corporate controversy. A privacy scandal that began with a third-party personality quiz has become a fight over how many times a platform can be penalized for repeating the same assurances at enormous scale.

From Cambridge Analytica to 43.9M violations

The case grew out of disclosures that Cambridge Analytica obtained personal data from as many as 87M Facebook profiles through a third-party app. The political consulting firm used the information to build voter profiles and support targeted political advertising during the 2016 U.S. election.

New Mexico sued Meta in 2021. The state argued that Facebook misled consumers about who could access their information, how the company protected privacy and how it addressed misinformation and hate speech on the platform. Meta disputed those claims and argued that New Mexico had not shown that residents saw the challenged statements or suffered harm because of them.

On September 25, 2026, a Santa Fe jury found Facebook liable for 43,899,725 violations of the state's consumer-protection law. The New Mexico Department of Justice described the verdict as the first state-led Cambridge Analytica case of its kind to reach a jury.

The number of violations changed the financial architecture of the dispute. Applying the statutory penalty to the jury's full count produced exposure above $219B. Judge Francis Mathew reduced the civil penalty to $25B. New Mexico had requested between $35B and $40B, while Meta argued that any award should be no more than $3.4B, according to Reuters.

That gap captures the argument now moving into appeal. The state sees millions of legally distinct deceptions. Meta sees a penalty disconnected from proof that individual New Mexicans encountered or were harmed by each statement.

Why the appeal now carries the story

The $25B is a court-ordered civil penalty, not a completed payment. The Associated Press reports that Meta plans to appeal and that interest would accrue while the case continues. The number of violations or the size of the award could be reduced.

The appeal will likely test how New Mexico converted platform-wide statements into 43.9M violations and whether the resulting penalty satisfies constitutional due-process limits. That makes the case about more than Facebook's past privacy language. It is also about how state consumer-protection laws behave when a digital platform can distribute one representation to millions of people.

Scale has always been the commercial advantage of the platform business. The same distribution machinery can become legal multiplication when a court decides that the message was deceptive.

New Mexico Attorney General Raúl Torrez has said money recovered in the case would flow to the state's education fund under the New Mexico Constitution. That outcome remains contingent on the appeal and collection process. The announcement creates a claim measured in billions; it does not put $25B into schools today.

Privacy language becomes operating evidence

Technology companies often treat privacy policies, transparency statements and product assurances as communications managed around the product. This verdict places those statements inside the product's legal exposure.

The distinction matters because Meta's case did not begin with a new breach in 2026. It began with the long afterlife of what Facebook told people while data moved through a third-party application and into political profiling. The scandal became public years ago. The statements surrounding it kept traveling through litigation, discovery, testimony and eventually a jury's violation count.

Meta previously paid a record $5B penalty to the Federal Trade Commission in 2019 over privacy violations and agreed to new compliance restrictions. The New Mexico judgment is a separate state case with a different legal theory, violation count and appellate path. Other recent Meta settlements and judgments involving child safety are also separate matters and should not be added to this $25B as though they were one proceeding.

For executives, legal teams and product leaders, the operating lesson sits in that separation. A settlement in one jurisdiction does not automatically erase another state's claims. A policy revision does not remove the history of earlier representations. A compliance program has to govern what the company says as closely as it governs what the system does.

What the $25B judgment leaves unresolved

The next record will come from the appeal: whether the 43,899,725 violations remain intact, whether the $25B survives constitutional review and when any payment obligation becomes enforceable.

Meta must also decide how aggressively to challenge a ruling that puts its public privacy language at the center of the company's financial exposure. New Mexico, meanwhile, has to defend a penalty that Judge Mathew already reduced far below the amount produced by the raw statutory calculation.

Cambridge Analytica disappeared years ago. The data practices and public assurances surrounding it did not disappear with the company. They kept moving through the legal system until each repetition acquired a price, and the appeal will decide how much of that price follows Meta forward.